Read the docs
TI-2026-78895 Aliases CVE-2026-92205GHSA-gmrm-4288-44px

Path traversal in BusyBox libarchive lets attackers create files

Priority LOW 27CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · Low
Fix status
Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 3.0 · CNA. Fix status from CNA and Red Hat.

Summary

BusyBox 1.37.0 is affected through its libarchive component. The component does not validate a user-supplied path before using it in file operations, a path traversal flaw (CWE-22). A remote attacker can create arbitrary files in the context of the current user if the target visits a malicious page or opens a malicious file.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of BusyBox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the libarchive component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of the current user. Was ZDI-CAN-27556.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00314 24th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
busyboxBusyBox1.37.0—No fix listedCNA
  • BusyBox Vendorbusybox Affected 1.37.0 Fixed in — No fix listed CNA

Remediation

Red Hat Hardened Images is fixed by RHSA-2026:81391, released 2026-10-12. Red Hat lists Red Hat Advanced Cluster Security 4 and Red Hat Enterprise Linux 6 as affected with no fix plan available. The sources list no fixed version for BusyBox.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Red Hat 1 advisory

  • RHSA-2026:81391 Released 2026-10-12 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images busybox-1:1.37.0-9.4.hum1@aarch64, busybox-1:1.37.0-9.4.hum1@s390x, busybox-1:1.37.0-9.4.hum1@src +7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Security 4AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 6AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:81391

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-92205
  2. 2026-10-21 Alias added: GHSA-gmrm-4288-44px
  3. 2026-10-22 Affected versions changed · Red Hat
  4. 2026-10-22 CVSS score added · Red Hat
  5. 2026-10-23 Priority changed: MEDIUM → LOW
  6. 2026-10-30 Affected versions changed · Red Hat
  7. 2026-10-30 CISA SSVC decision points changed
  8. 2026-11-06 Fix available: RHSA-2026:81391 · Red Hat
  9. 2026-11-06 Fix available: Red Hat Hardened Images · Red Hat

References

Other 1

  • TI-2016-05394 The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote… CVSS 3.1HIGH 7.5
  • TI-2018-15900 Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget"… CVSS 3.1HIGH 8.1
  • TI-2018-15917 BusyBox project BusyBox wget version prior to commit… CVSS 3.1CRITICAL 9.8
  • TI-2016-01959 Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows… CVSS 3.1CRITICAL 9.8
  • TI-2025-37846 BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in… CVSS 3.1MEDIUM 6.5
  • TI-2023-22583 A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of… CVSS 3.1MEDIUM 5.5
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences